# Beacon

Document Sample

```					A Verifiable Random Beacon

Luis von Ahn
Carnegie Mellon University
A Random Beacon…

A Random Beacon continually emits
random integers 1  i  k regularly spaced
apart in time.

7   3       11   1   2   9

A Random Beacon…

All integers emitted by the Beacon are
time-stamped and signed.

S(7,t)   S(3,t+)   S(11,t+2)
A Random Beacon…

We will assume that the Beacon is trusted:
nobody knows or can predict in advance the
value of the next integer (Not even the
owner of the Beacon).
Applications: Lotteries
Applications: Contract Signing

Alice and Bob negotiate a contract C.

If Alice signs C and sends it to Bob,
then he can delay the return of his
signature. During this time Alice is
committed to C but Bob is not.

This problem is usually solved
using a trusted third party
Applications: Contract Signing

Using a Random Beacon, Alice and Bob can
sign a contract with a very small probability
of being able to cheat.

Rabin ‘83
Contract Signing with a Beacon

If for some Beacon       If for some Beacon
message M, Bob can       message M, Alice
produce                  can produce

M signed by Beacon       M signed by Beacon
and                      and
(C, M) signed by Alice   (C, M) signed by Bob

then I, Alice, will be   then I, Bob, will be
committed to C.          committed to C.

Signed Alice.           Signed Bob.
Contract Signing with a Beacon
If for some Beacon
message M, Alice can
produce
C takes effect if
Alice
M signed by Beacon         the pair (i,t)    Bob
Choose a
and
matches a Beacon
(C, M) signed by Bob
(future) time t              message
then I, Bob, will be
committed to C.                t
Choose 1  i  k
Signed Bob.
i

SAlice(C, (i,t))

SBob(C, (i,t))
Alice and Signing with a Beacon
ContractBob iterate this procedure
>> k times

Alice                                  Bob
Choose a
(future) time t
t
Choose 1  i  k

i

SAlice(C, (i,t))

SBob(C, (i,t))
w.h.p. some pair (i,t) with a beacon
Contract Signingmatches aBeacon
message

Alice                                  Bob
Choose a
(future) time t
t
Choose 1  i  k

i

SAlice(C, (i,t))

SBob(C, (i,t))
Contract Signing with a Beacon
The probability of Bob being able to
cheat is 1/k

Alice                                  Bob
Choose a
(future) time t
t
Choose 1  i  k

i

SAlice(C, (i,t))

SBob(C, (i,t))
Contract Signing with a Beacon

How is this better than the regular trusted
party solution?
Applications: Fuhrman Buster

Mark Fuhrman, a detective in the OJ
Simpson case, was accused of presenting
modified tapes of the crime scene to the
court.

The Fuhrman Buster is a video camera that
prevents anybody from introducing modified
tapes to court.

Bennett ‘97
Fuhrman Busting with a Beacon

Beacon
Fuhrman Buster

hash
Crime Scene

This prevents pre-recordings,
Repository   as well as post-editings!
Other Applications?
We want to build a Random
Beacon here at CMU!
To do…

Get truly random bits

Convince everybody that we should be
trusted

\$\$\$ Win the lottery \$\$\$
www.lavarand.sgi.com

SGI has a random
beacon.
Their random numbers
come from lava lamps.
Bits from Pulsars

On        Off

Nobody knows how to predict the amplitude
of the next pulse.

We can output 1 if the measured amplitude is
above the median and 0 if it is below.
To do…

Get truly random bits

Convince everybody that we should be
trusted

\$\$\$ Win the lottery \$\$\$
To do…

Get truly random bits

Convince everybody that we should be
trusted

\$\$\$ Win the lottery \$\$\$
www.lavarand.sgi.com

They convince us to
trust them by showing
a live picture of the
lamp that generates
the bits.
It is hard to convince
people to trust you
Lavarand + Fuhrman Buster

Though this appears circular, the idea is
not totally out the question.
To do…

Get truly random bits

Convince everybody that we should be
trusted

\$\$\$ Win the lottery \$\$\$
Bits from Pulsars
Some pulsars can be seen from anywhere in the
northern hemisphere
B0329+54

If we get our bits from pulsars, others can see
that we are outputting the right bits!
A Verifiable Random Beacon

We will convince people to trust us by
getting our random bits in a way that:

others can verify that we are not
modifying the stream
Wait a Second…

Measurement Error: no two measurements of
the pulse amplitude will be exactly the same!

This might allow us to win the lottery! If
someone disagrees with our measurements, we
can always say it was a measurement error.

0010101110001010110
Wait a Second…

Measurement Error: no two measurements of
the pulse amplitude will be exactly the same!

This might allow us to win the lottery! If
someone disagrees with our measurements, we
can always say it was a measurement error.

0010101110001010110
Wait a Second…

Measurement Error: no two measurements of
the pulse amplitude will be exactly the same!

This might allow us to win the lottery! If
someone disagrees with our measurements, we
can always say it was a measurement error.

0001101110001010111
But we want to be trusted, so we want to find a
way in which our bits always agree with the
verifier’s bits.

A and B are chosen uniformly from {0,1}n
A and B are highly correlated:   Pr(Ai  Bi) = e
We want h:{0,1}n  {0,1} balanced such that

Pr( h(A)  h(B) ) < e
Ke Yang: If A and B are chosen uniformly from
{0,1}n and Pr(Ai  Bi) = e then for all balanced
h:{0,1}n  {0,1}, we have

Pr( h(A)  h(B) )  e

According to this, our best bet is to make e
as small as possible.
But there is hope…
It is not true that the owner of the beacon
can change whichever bit she wants
Ideas are welcome

```
DOCUMENT INFO
Shared By:
Categories:
Tags:
Stats:
 views: 2 posted: 10/12/2012 language: Unknown pages: 36